Skip to content

Commit c00cbd6

Browse files
author
Test User
committed
Add fix for ecdsa 192 and rsa tests
1 parent 3ff6247 commit c00cbd6

File tree

3 files changed

+86
-36
lines changed

3 files changed

+86
-36
lines changed

‎debian/rules‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,4 +82,6 @@ override_dh_auto_clean:
8282
rm -rf test/standalone/tests/.libs
8383

8484
override_dh_auto_test:
85+
# Set LD_LIBRARY_PATH to find installed wolfSSL/OpenSSL libraries
86+
export LD_LIBRARY_PATH=/usr/lib/$(DEB_HOST_MULTIARCH):$$LD_LIBRARY_PATH && \
8587
$(MAKE) test

‎test/test_ecc.c‎

Lines changed: 61 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -958,6 +958,36 @@ int test_ecdsa_p192_pkey(void *data)
958958
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_192));
959959
err = pkey == NULL;
960960
}
961+
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
962+
/* In FIPS mode, P-192 operations are not allowed, so we expect all operations to fail */
963+
if (err == 0) {
964+
PRINT_MSG("Sign with OpenSSL");
965+
ecdsaSigLen = sizeof(ecdsaSig);
966+
err = test_pkey_sign_ecc(pkey, osslLibCtx, buf, sizeof(buf), ecdsaSig,
967+
&ecdsaSigLen);
968+
/* OpenSSL should also reject P-192 in FIPS mode */
969+
err = err != 1;
970+
if (err == 0) {
971+
PRINT_MSG("OpenSSL sign failed, expected (P-192 not allowed w/ FIPS)");
972+
}
973+
else {
974+
PRINT_MSG("OpenSSL sign succeeded, unexpected (P-192 not allowed w/ FIPS)");
975+
}
976+
}
977+
if (err == 0) {
978+
PRINT_MSG("Sign with wolfprovider");
979+
ecdsaSigLen = sizeof(ecdsaSig);
980+
err = test_pkey_sign_ecc(pkey, wpLibCtx, buf, sizeof(buf), ecdsaSig,
981+
&ecdsaSigLen);
982+
err = err != 1;
983+
if (err == 0) {
984+
PRINT_MSG("ECDSA failed, expected (P-192 not allowed w/ FIPS)");
985+
}
986+
else {
987+
PRINT_MSG("ECDSA succeeded, unexpected (P-192 not allowed w/ FIPS)");
988+
}
989+
}
990+
#else
961991
if (err == 0) {
962992
PRINT_MSG("Sign with OpenSSL");
963993
ecdsaSigLen = sizeof(ecdsaSig);
@@ -982,17 +1012,6 @@ int test_ecdsa_p192_pkey(void *data)
9821012
ecdsaSigLen = sizeof(ecdsaSig);
9831013
err = test_pkey_sign_ecc(pkey, wpLibCtx, buf, sizeof(buf), ecdsaSig,
9841014
&ecdsaSigLen);
985-
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
986-
err = err != 1;
987-
if (err == 0) {
988-
PRINT_MSG("ECDSA failed, expected (P-192 not allowed w/ FIPS)");
989-
}
990-
else {
991-
PRINT_MSG("ECDSA succeeded, unexpected (P-192 not allowed w/ "
992-
"FIPS)");
993-
}
994-
}
995-
#else
9961015
}
9971016
if (err == 0) {
9981017
PRINT_MSG("Verify with OpenSSL");
@@ -1250,6 +1269,37 @@ int test_ecdsa_p192(void *data)
12501269
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_192));
12511270
err = pkey == NULL;
12521271
}
1272+
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
1273+
/* In FIPS mode, P-192 operations are not allowed, so we expect all operations to fail */
1274+
if (err == 0) {
1275+
PRINT_MSG("Sign with OpenSSL");
1276+
ecdsaSigLen = sizeof(ecdsaSig);
1277+
err = test_digest_sign(pkey, osslLibCtx, buf, sizeof(buf), md,
1278+
ecdsaSig, &ecdsaSigLen, 0);
1279+
/* OpenSSL should also reject P-192 in FIPS mode */
1280+
err = err != 1;
1281+
if (err == 0) {
1282+
PRINT_MSG("OpenSSL sign failed, expected (P-192 not allowed w/ FIPS)");
1283+
}
1284+
else {
1285+
PRINT_MSG("OpenSSL sign succeeded, unexpected (P-192 not allowed w/ FIPS)");
1286+
}
1287+
}
1288+
if (err == 0) {
1289+
PRINT_MSG("Sign with wolfprovider");
1290+
ecdsaSigLen = sizeof(ecdsaSig);
1291+
err = test_digest_sign(pkey, wpLibCtx, buf, sizeof(buf), md,
1292+
ecdsaSig, &ecdsaSigLen, 0);
1293+
err = err != 1;
1294+
if (err == 0) {
1295+
PRINT_MSG("ECDSA failed, expected (P-192 not allowed w/ FIPS)");
1296+
}
1297+
else {
1298+
PRINT_MSG("ECDSA succeeded, unexpected (P-192 not allowed w/ "
1299+
"FIPS)");
1300+
}
1301+
}
1302+
#else
12531303
if (err == 0) {
12541304
PRINT_MSG("Sign with OpenSSL");
12551305
ecdsaSigLen = sizeof(ecdsaSig);
@@ -1275,17 +1325,6 @@ int test_ecdsa_p192(void *data)
12751325
ecdsaSigLen = sizeof(ecdsaSig);
12761326
err = test_digest_sign(pkey, wpLibCtx, buf, sizeof(buf), md,
12771327
ecdsaSig, &ecdsaSigLen, 0);
1278-
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
1279-
err = err != 1;
1280-
if (err == 0) {
1281-
PRINT_MSG("ECDSA failed, expected (P-192 not allowed w/ FIPS)");
1282-
}
1283-
else {
1284-
PRINT_MSG("ECDSA succeeded, unexpected (P-192 not allowed w/ "
1285-
"FIPS)");
1286-
}
1287-
}
1288-
#else
12891328
}
12901329
if (err == 0) {
12911330
PRINT_MSG("Verify with OpenSSL");

‎test/test_rsa.c‎

Lines changed: 23 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -560,9 +560,8 @@ int test_rsa_sign_sha1(void *data)
560560

561561
(void)data;
562562
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
563-
/* Signing with wolfProvider should fail, but verifying with wolfProvider should
564-
* succeed. In FIPS mode, we can only verify RSA signatures using SHA-1, not
565-
* generate them. */
563+
/* Signing with SHA-1 is not allowed in FIPS mode.
564+
* We expect both OpenSSL and wolfProvider to reject SHA-1 signing. */
566565
EVP_PKEY *pkey = NULL;
567566
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
568567
const RSA *rsaKey = NULL;
@@ -594,17 +593,26 @@ int test_rsa_sign_sha1(void *data)
594593
PRINT_MSG("Sign with OpenSSL");
595594
err = test_digest_sign(pkey, osslLibCtx, buf, sizeof(buf), "SHA-1",
596595
rsaSig, &rsaSigLen, 0);
597-
}
598-
if (err == 0) {
599-
PRINT_MSG("Verify with wolfprovider");
600-
err = test_digest_verify(pkey, wpLibCtx, buf, sizeof(buf), "SHA-1",
601-
rsaSig, rsaSigLen, 0);
596+
/* OpenSSL should reject SHA-1 signing in FIPS mode */
597+
err = err != 1;
598+
if (err == 0) {
599+
PRINT_MSG("OpenSSL sign failed, expected (SHA-1 signing not allowed w/ FIPS)");
600+
}
601+
else {
602+
PRINT_MSG("OpenSSL sign succeeded, unexpected (SHA-1 signing not allowed w/ FIPS)");
603+
}
602604
}
603605
if (err == 0) {
604606
PRINT_MSG("Sign with wolfprovider");
605607
rsaSigLen = RSA_size(rsaKey);
606608
err = test_digest_sign(pkey, wpLibCtx, buf, sizeof(buf), "SHA-1",
607609
rsaSig, &rsaSigLen, 0) != 1;
610+
if (err == 0) {
611+
PRINT_MSG("wolfProvider sign failed, expected (SHA-1 signing not allowed w/ FIPS)");
612+
}
613+
else {
614+
PRINT_MSG("wolfProvider sign succeeded, unexpected (SHA-1 signing not allowed w/ FIPS)");
615+
}
608616
}
609617
EVP_PKEY_free(pkey);
610618

@@ -1045,13 +1053,8 @@ int test_rsa_pkey_invalid_key_size(void *data) {
10451053
err = RAND_bytes(buf, sizeof(buf)) == 0;
10461054
}
10471055

1048-
if ((err == 0) && (!noKeyLimits)) {
1049-
PRINT_MSG("Check that signing with an invalid key size fails.");
1050-
err = test_pkey_sign(pkey, wpLibCtx, buf, sizeof(buf), rsaSig,
1051-
&rsaSigLen, 0, NULL, NULL) == 0;
1052-
}
1053-
10541056
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
1057+
/* In FIPS mode, 1024-bit keys are allowed, so skip the invalid key size check */
10551058
if (err == 0) {
10561059
PRINT_MSG("Check that signing with OpenSSL and verifying with "
10571060
"wolfProvider using a 1024-bit key works.");
@@ -1062,6 +1065,12 @@ int test_rsa_pkey_invalid_key_size(void *data) {
10621065
err = test_pkey_verify(pkey, wpLibCtx, buf, sizeof(buf), rsaSig,
10631066
rsaSigLen, 0, NULL, NULL);
10641067
}
1068+
#else
1069+
if ((err == 0) && (!noKeyLimits)) {
1070+
PRINT_MSG("Check that signing with an invalid key size fails.");
1071+
err = test_pkey_sign(pkey, wpLibCtx, buf, sizeof(buf), rsaSig,
1072+
&rsaSigLen, 0, NULL, NULL) == 0;
1073+
}
10651074
#endif /* HAVE_FIPS || HAVE_FIPS_VERSION */
10661075

10671076
EVP_PKEY_free(pkey);

0 commit comments

Comments
 (0)